According to the following, the Win7 (NON-SERVER) version of the MS14-68 patch has no real apparent purpose, at least not one that is documented. https://nakedsecurity.sophos/2014/11/19/microsoft-tops-up-patch-tuesday-issues-delayed-fix-for-zero-day-hole-in-logon-security/ excerpt: … Critical hole The MS14-068 bug is in the Kerberos Key Distribution Center (KDC), a vital service that runs on Windows Active Directory domain controllers to deal with logon security. We shant try to explain Kerberos here, other than to say that its a cryptographic ticketing system that hands out session keys as part of the logon process. Kerberos tickets are a bit like hotel room keys that are encoded at the front desk after a security check, and then handed over to give you access, for a limited period, to specific parts of the building. So, if theres a security flaw in KDC, the best-of-the-worst outcome you could hope for is some kind of Elevation of Privilege (EoP) or Security Bypass bug, either of which would allow an attacker to acquire access rights they shouldnt have. The MS14-068 bug is an EoP: it pretty much lets anyone who can logon to your domain at all, even as the most junior sort of user, to turn themselves into a domain administrator, the most powerful force in a Windows network. Thats like a guest with an access card for an overnight stay in Room 1337 being able to transform his card into an access-all-areas-at-all-times skeleton key. Worse still, MS14-068 is not a privately disclosed hole. … Microsoft reports, in the strangely euphemistic terminology youve probably learned to associate with bad security news, that it was aware of limited, targeted attacks that attempt to exploit this vulnerability. … Microsoft has issued patches for all Windows flavours, including desktop versions that arent directly at risk because they arent Active Directory domain controllers and dont have the offending Kerberos services running. As for why did Microsoft patch everything, just in case, the best answer we can think of is, Because it could. Patching just in case is a bit like encrypting everything, even files that arent confidential, on the grounds that then you dont have to worry whether you left anything out. …
Posted on: Thu, 20 Nov 2014 16:38:29 +0000
Trending Topics
Recently Viewed Topics
© 2015